Katalog CVE (hal. 290)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 259.986 (Critical 36.028 · High 103.893 · KEV 1.748 · sejak 2020) · Pembaruan terakhir: 20 Okt 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 14.451–14.500 dari 259.986 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-92962 vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds...	2.1 Low	—	0,16%	17 Sep 2026
CVE-2026-92961 vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory....	7.5 High	—	0,53%	17 Sep 2026
CVE-2026-92960 vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network...	10.0 Critical	—	0,47%	17 Sep 2026
CVE-2026-92959 vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async no...	7.1 High	—	0,45%	17 Sep 2026
CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builti...	8.5 High	—	0,38%	17 Sep 2026
CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Altho...	9.9 Critical	—	0,54%	17 Sep 2026
CVE-2026-92956 vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAs...	10.0 Critical	—	0,59%	17 Sep 2026
CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._...	10.0 Critical	—	0,71%	17 Sep 2026
CVE-2026-92954 vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not...	8.6 High	—	0,49%	17 Sep 2026
CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to...	10.0 Critical	—	0,50%	17 Sep 2026
CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and...	6.8 Medium	—	0,46%	17 Sep 2026
CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package...	9.9 Critical	—	0,54%	17 Sep 2026
CVE-2026-92950 vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can suppl...	8.6 High	—	0,20%	17 Sep 2026
CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.r...	4.0 Medium	—	0,32%	17 Sep 2026
CVE-2026-92948 vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly a...	9.9 Critical	—	0,65%	17 Sep 2026
CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. San...	10.0 Critical	—	0,48%	17 Sep 2026
CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed c...	10.0 Critical	—	0,86%	17 Sep 2026
CVE-2026-92945 vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison....	4.2 Medium	—	0,28%	17 Sep 2026
CVE-2026-92944 vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stal...	9.8 Critical	—	0,84%	17 Sep 2026
CVE-2026-92942 vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps...	7.5 High	—	0,49%	17 Sep 2026
CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wi...	10.0 Critical	—	0,29%	17 Sep 2026
CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). Th...	10.0 Critical	—	0,47%	17 Sep 2026
CVE-2026-92939 vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only...	9.9 Critical	—	0,62%	17 Sep 2026
CVE-2026-92938 vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin...	9.9 Critical	—	0,62%	17 Sep 2026
CVE-2026-92937 vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate...	10.0 Critical	—	1,0%	17 Sep 2026
CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm s...	5.8 Medium	—	0,46%	17 Sep 2026
CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts...	9.0 Critical	—	0,67%	17 Sep 2026
CVE-2026-92934 vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within...	9.0 Critical	—	0,76%	17 Sep 2026
CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.as...	5.8 Medium	—	0,37%	17 Sep 2026
CVE-2026-92879 A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resour...	4.3 Medium	—	0,59%	17 Sep 2026
CVE-2026-90986 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.	7.1 High	—	0,25%	17 Sep 2026
CVE-2026-90887 Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.	7.1 High	—	0,25%	17 Sep 2026
CVE-2026-89418 google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire...	8.7 High	—	0,28%	17 Sep 2026
CVE-2026-86533 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A r...	9.1 Critical	—	0,91%	17 Sep 2026
CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting...	6.3 Medium	—	0,74%	17 Sep 2026
CVE-2026-85500 Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email conf...	9.1 Critical	—	0,77%	17 Sep 2026
CVE-2026-82761 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use...	9.1 Critical	—	0,56%	17 Sep 2026
CVE-2026-82760 Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 se...	8.2 High	—	0,74%	17 Sep 2026
CVE-2026-82759 Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that th...	1.8 Low	—	0,14%	17 Sep 2026
CVE-2026-82723 Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store....	1.8 Low	—	0,18%	17 Sep 2026
CVE-2026-82685 Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's...	7.6 High	—	0,66%	17 Sep 2026
CVE-2026-81829 A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB k...	5.3 Medium	—	0,59%	17 Sep 2026
CVE-2026-81637 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and si...	2.3 Low	—	0,61%	17 Sep 2026
CVE-2026-81632 Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser hist...	7.2 High	—	0,21%	17 Sep 2026
CVE-2026-81453 dell openmanage server administrator Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability...	6.5 Medium	—	0,45%	17 Sep 2026
CVE-2026-81443 dell openmanage server administrator Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote acces...	6.4 Medium	—	0,23%	17 Sep 2026
CVE-2026-81442 dell openmanage server administrator Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access co...	8.1 High	—	0,38%	17 Sep 2026
CVE-2026-80355 dell openmanage server administrator Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote acce...	5.4 Medium	—	0,21%	17 Sep 2026
CVE-2026-80218 Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a use...	7.6 High	—	0,64%	17 Sep 2026
CVE-2026-78528 Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.	5.3 Medium	—	0,29%	17 Sep 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.